Compression and security headers in NestJS - Cheat Sheet & Quick Revision

Recall & Review

beginner

What is the purpose of compression middleware in a NestJS application?

Compression middleware reduces the size of the response body sent to clients. This makes data transfer faster and saves bandwidth, improving app performance.

beginner

Name a common security header that helps prevent cross-site scripting (XSS) attacks.

The Content-Security-Policy (CSP) header helps prevent XSS by specifying which sources of content are allowed to load on the page.

intermediate

How do you enable compression in a NestJS app using middleware?

You can enable compression by installing the 'compression' package and applying it as middleware in the main app file using app.use(compression()).

intermediate

What does the 'helmet' package do in a NestJS project?

Helmet sets various HTTP headers to secure your app from common vulnerabilities like clickjacking, MIME sniffing, and XSS.

beginner

Why is it important to set security headers in your NestJS backend?

Security headers protect users by controlling browser behavior, reducing risks like data theft, code injection, and clickjacking.

Which package is commonly used to add compression middleware in NestJS?

A express-session

B helmet

C cors

D compression

The 'compression' package is used to compress response bodies in NestJS.

What does the 'helmet' package primarily help with?

A Adding security headers

B Compressing responses

C Managing sessions

D Handling CORS

Helmet sets security-related HTTP headers to protect the app.

Which security header helps prevent clickjacking attacks?

A X-Frame-Options

B Content-Type

C Cache-Control

D Authorization

X-Frame-Options prevents your site from being framed by other sites, blocking clickjacking.

How do you apply compression middleware in a NestJS app?

A app.set('compression', true)

B app.enableCompression()

C app.use(compression())

D app.useHelmet()

You apply compression middleware by calling app.use(compression()).

Which header controls which external resources can be loaded on a page?

A X-Powered-By

B Content-Security-Policy

C ETag

D Accept-Encoding

Content-Security-Policy defines allowed sources for scripts, styles, and other resources.

Explain how to add compression and security headers in a NestJS application.

Think about middleware setup in main.ts and what each package does.

Describe why security headers are important and name three common headers used in NestJS apps.

Consider how browsers behave with these headers.